With the passage of the Patient Protection and Affordable Care Act (PPACA), 1Congress has boldly taken a second step in its funding and support of a national program for Comparative Effectiveness Research (CER). 2CER is the generation and synthesis of evidence that compares the benefits and harms of alternative methods to prevent, diagnose, treat and monitor a clinical condition or to improve the delivery of care. 3Building on the established paradigms that already exist in evidence-based medicine, CER seeks to provide comparison data and information about the clinical outcomes, effectiveness and appropriateness of drugs, devices, clinical treatments and procedures that are used to prevent, diagnose, or treat disease, disorders and other health conditions effecting the population. 4

The intent of CER, in general and as defined in PPACA, is to provide useful and practical information to clinicians, healthcare providers and health insurers to ensure that the most effective interventions are delivered to patients at the individual level and across the population as a whole. 5By conducting such “head to head” comparison studies, it is expected to improve the quality of healthcare delivered and result in a reduction in costs. 6Thus beyond curtailing the rising costs of healthcare in the U.S., CER has the potential to substantially improve the way healthcare is managed and delivered across the country.

Institutional Considerations. Invariably because of the possible improvements in healthcare delivery and reduction in costs, many healthcare organizations, including hospitals and third-party insurers, will be involved in CER. The research methodological approaches to CER include conducting systematic reviews of existing literature, electronic database research patient information, observational studies and randomized clinical trials. 7Although funding has been established for infrastructure and program activities, no consideration has been given as of yet to the legal, ethical and regulatory implications of comparative effectiveness research. Organizations considering engaging in CER must be cognizant of some of the legal, ethical and regulatory implications involved in CER.

Regulatory Guidance for CER. It is imperative that organizations interested in participating in CER consider how CER activities fit within their existing regulatory compliance programs, including those involving human subjects research, in advance of regulatory guidance. Although the Department of Health and Human Services (DHHS) is expected to work closely with the Patient-Centered Outcomes Research Institute, the non-governmental entity established to provide oversight to CER, the Office of Human Research Protections (OHRP) for example has not given consideration to the regulatory impact of CER. 8Unlike evidence based medicine activities which are often conducted as “quality improvement” activities, CER falls squarely within the definition of “research” 9and will likely fall within the purview of the OHRP. OHRP, while providing leadership in the protection of the rights, welfare and well-being of subjects participating in human subjects research, also promulgates regulatory guidance for DHHS supported research. 10This includes guidance to organizations with Institutional Review Boards or Ethics Committees that routinely review human subjects’ research activities within their organizations.

Institutional Review Boards have long provided oversight to clinical trials and other research studies involving human subjects and therefore, will likely provide oversight to CER activities, as well. In some aspects, existing IRB regulatory guidance is incompatible with the intent of CER activities since CER activities encompass both traditional notions of clinical trial research and health care quality improvement activities For example, using established review criteria, IRBs must make a number of ethical determinations in regulating research, including whether the risks to subjects are reasonable in relation to anticipated benefits. 11While the risks to participants of any CER primary research study may be readily identifiable from the side effects, the benefits of participation are analogous to those seen in health care quality improvement activities. Thus, the ethical determinations will likely differ from the traditional clinical research context and must be articulated in the informed consent.] Moreover, OHRP regulatory guidance specifically states that “the IRB should not consider possible long-range effects of applying knowledge gained in the research” including the possible effects it might have on public policy; in contrast, CER studies are specifically focused on the short and long range effects, including the possible changes to the standards of care widely used today. 12Such guidance is in conflict with the underlying precepts of CER since the intent of CER is to provide the critical information to clinicians to be used in establishing best medical practices. 13Therefore, until such time as the federal regulatory agencies have provided sufficient regulatory guidance updates, IRBs must be prepared to review CER studies from an alternative perspective, armed primarily with an understanding of the intent of CER, rather than relying on the current regulatory guidance.

Ensuring the Adequacy of Informed Consent. As a general principle, the informed consent for research should explain in sufficient detail all of the information that a reasonable person would want to know to about participating in a study. 14Ensuring the adequacy of informed consent in CER studies will pose a number of ethical challenges for IRBs reviewing the informed consent for CER randomized clinical trials. These trials are intended to fill the knowledge gap that exists in comparing two approved medical interventions, specifically in targeted segments of the population (e.g., race, ethnicity, gender) that may not have been the focus of the study in the drug or device FDA approval process. 15The informed consent, while identifying the risks and benefits of participation in CER randomized clinical trials, must address the unique nature of CER studies, specifically, that the study is designed to provide information about the choices made in clinical practice between one or more treatment alternatives. 16IRBs must be cautious not to overstate the benefits since no “experimental arm” is implicated in the research and the underlying randomization may be between two (or more) suitable alternatives currently utilized in medical practice. Although the risks are not comparable to that involved in an experimental research clinical trial 17, there exists the risk of receiving a treatment alternative that may be less efficacious based on the research participant’s race or gender. Finally, there are also risks that a third-party insurer may not pay for the related costs of the interventions involved in CER during the study and potentially thereafter, although this aspect of CER has yet to be determined. 18The informed consent provided to the potential research participant must make notable distinctions with clearly articulated risks and benefits.

Privacy of Medical Information. CER studies will rely heavily on access to large scale databases of patient medical information to provide considerable comparative data across various segments of the population. 19Critical data will be necessary from stakeholders including information held by large national insurers, integrated health systems and practice-based research networks. 20Access to patient registry information, as well as information and data related to the outcomes of currently utilized treatment interventions from clinicians is also crucial to the effective implementation of any CER study. 21Thus, ensuring the privacy of this data on a large scale will be critical.

While the HIPAA Privacy Rule 22is intended to protect the confidential nature of individually identifiable protected health information, since its implementation, it has been widely criticized as impeding the growth of health related research. 23To the extent possible to meet study objectives, researchers engaged in CER studies will be able to successfully utilize “deidentified health information” or “limited data sets” in order to maintain patient privacy and confidentiality. 24However, a number of studies may require linkages to different databases at the individual level and therefore, may require accessing individual patient identifying information in order to ensure the adequacy of the information and therefore, an authorization at a minimum may be required from the participant. 25

In addition, the effective implementation of CER on a national level requires extensive coordination among healthcare organizations. CER’s success is contingent on data sharing among the numerous organizational stakeholders across the various sectors of healthcare. Collaboration, while not specifically mandated in the anticipated funding guidelines for CER, is encouraged to broaden the diversity of information across geographical regions of the United States. Invariably with collaboration across entities there will be greater access to information by the CER workforce. This will mandate a heightened awareness of the HIPAA privacy and security regulations 26and an infrastructure that provides training for an expanded CER workforce in order to adequately protect individual privacy. Organizations involved in CER research should give serious consideration to existing HIPAA training strategies to reduce the potential liability associated with a breach of privacy as the result of CER activities.

Conclusion

CER is considered an essential part of reforming the nation’s healthcare system. 27In PPACA, the federal government has made a substantial supplemental investment in supporting the continued growth of the CER infrastructure and the further development of CER programs to ensure its success. Yet as is the case in any governmental reform, there will be implementation challenges and unanticipated consequences. While evidence based medicine and health outcomes research have existed for decades in the United States, the establishment and support of a national CER initiative by the federal government is likely to pose a set of unique challenges that require further legal and regulatory clarification. Until such time as the regulatory infrastructure is consistent with CER, organizations must recognize these challenges and understand the implications of organizational decision making on the CER enterprise.

In the American Recovery and Reinvestment Act (ARRA) of 2009 (P.L. 111-5), Congress appropriated approximately $1.1 billion to support CER activities in the U.S. This unprecedented amount of funding, intended as a down-payment for future federal support, included establishing the initial infrastructure and funding priorities for future CER activities in the U.S.

45 CFR Part 46.102(d) (2009) The term “ r esearch is defined as “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.”

Health Insurance Portability and Accountability Act (HIPAA) of 1996 §§261-264; 45 CFR § 164.101 et..seq. HIPAA’s Privacy Rule allows institutions to de-identify data by removing all of the 18 elements that could be used to identify an individual. A limited data set is a data set that excludes 16 of the HIPAA Privacy Rule direct identifiers and may be used or disclosed, for purposes of research, public health, or health care operations, without obtaining either an individual's Authorization or a waiver or an alteration of Authorization for its use and disclosure, with a data use agreement. U.S. Department of Health and Human Services, National Institutes of Health, HIPAA Privacy Rule, Information for Researchers, http://privacyruleandresearch.nih.gov/pr_08.asp

Id. This is particularly the case when utilizing larger national datasets from a variety of sources (e.g., pharmacies, clinical offices, hospitals) which potentially lack standardized definitions or may not otherwise be electronically compatible.

HIPAA’s Privacy Rule allows for the use of protected health information for research without an individual’s authorization in limited circumstances including with a waiver of the Authorization requirement by an IRB or Privacy Board, as a limited data set with a data use agreement, preparatory to research, and for research on decedents' information. HIPAA’s Security Rule provides strict guidelines governing the appropriate administrative, physical and technical safeguards of an individual’s protected health information to ensure its confidentiality, integrity, and security. U.S. Department of Health and Human Services, Office of Civil Rights, Health Information Privacy, http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/index.html